Configure Winlogbeat according to the example configuration below. Replace <YOUR_TOKEN> with the token you copied in step 3. Enter the names of the Windows event logs you want to stream. In our example we're using logstash for the output: